3

I am looking to secure our console ports in our remote console router equipped with HWIC-16A cards and RS232 cables.

As the network admins, we usually login to these routers first (using privilege 15 accounts via TACACS+) then connect to our hosts by telnet to their corresponding ports

eg. telnet 1.1.1.1 2021

Now our server guys have obtained devices that can be managed by console access and they'd like to use our routers for this. They have a read-only account that we've setup with "privilege 5" access.

I've provided them with "telnet 192.168.0.5 2020" which will have them login once to the router and then prompting to login with their read-only account.

The problem I found is that they're able to console connect to our firewalls which lives on port 2021.

Is there a way to limit connections to port 2021 to only users with privilege 15?

I've tried entering "privilege 15" on line 0/1/1 which port 2021 resides on and I can still access our firewall's console with read-only account.

All our network devices authenticates with TACACS+ and read-only access are not permitted to firewalls. I am looking to secure these connections further as usage of our router may increase over time!

Any help is appreciated. Thank you!

Improve this question
4
  • 4
    Maybe it is too obvious to me, but seems like you should have aaa enabled on the console. If you don't, all someone needs to do is access the equipment, disconnect your console connection and connect their own to get access. Enabling the aaa login on the console should resolve both issues.
    – YLearn
    Feb 3, 2015 at 21:32
  • To me, this is a management issue, not a technical one. Why are server guys making firewall changes? Or are you just worried that they might?
    – Ron Trunk
    Feb 4, 2015 at 11:25
  • Ron, server guys are not making firewall changes. We're just looking for ways to lock down each port to either a username or a privilege level.
    – caide
    Feb 4, 2015 at 18:23
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 11, 2017 at 4:13

1 Answer 1

Reset to default
3

Assuming you're running relevant code, the aaa authorization reverse-access would let you determine what users are allowed to access which reverse-telnet ports.

You will need to configure your tacacs server to provide the correct authorization.

There is an example in the command reference.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.